Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

MalVis: A Large-Scale Image-Based Framework and Dataset for Advancing Android Malware Classification

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MalVis-B encodes Android bytecode entropy and bi-gram transitions into RGB images and outperforms prior malware visualizations.

desk verdict A genuinely new entropy-plus-bigram RGB encoding and a large public Android image dataset, but the image-level split is not ruled out, so the headline accuracy numbers should not be trusted until app-grouped splits are shown. read the letter →

arxiv 2505.12106 v1 pith:LENRQ4TH submitted 2025-05-17 cs.CR

Saleh J. Makkawy , Michael J. De Lucia , Kenneth E. Barner This is my paper · ORCID
classification cs.CR
keywords AndroidmalwaredetectionvisualizationentropyencodingN-gramanalysisconvolutionalneuralnetworksRGBbytecodeimagesMalVisdatasetbinaryclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a visualization method called MalVis-B lets convolutional networks detect Android malware better than earlier image-based methods. MalVis-B colors each pixel of a 256×256 image three ways: Shannon entropy over 32-byte windows drives the red and blue channels, while a bi-gram value computed from consecutive bytes drives the green channel. The authors report 95.19% accuracy, 90.81% F1-score, and 98.06% ROC-AUC with Inception-V3 on binary malware-versus-benign classification, and they say MalVis-B beats the MalNet, Classbyte, and entropy-only baselines on most backbones. They also release MalVis, a public dataset of over 1.3 million such images spanning nine malware classes and one benign class. If the claim holds, security analysts get an interpretable, obfuscation-sensitive image representation and a large common benchmark for testing it.

What carries the argument

The load-bearing object is the MalVis-B encoding, a three-channel RGB image built from the classes.dex bytes of an app. The red and blue channels come from Shannon entropy over a 32-byte sliding window, with a curved scaling on the red channel and a squared-entropy scaling on the blue channel; the green channel carries the normalized bi-gram value $g=(b_1\cdot 256+b_2)/65535$, which treats each pair of consecutive bytes as a transition. The one-dimensional byte array is reshaped to a fixed 256×256 grid using nearest-neighbor interpolation. This machinery is what lets a generic CNN see encryption as bright high-entropy regions and repacking or other structural anomalies as bright bi-gram textures, and it is the component the paper varies when it tests MalVis-A's Classbyte green channel in place of the bi-gram.

What would settle it

Compute the overlap between source APKs in the training and test partitions of MalVis, then rerun the binary Inception-V3 experiment with a group-aware split that keeps each app's images in one partition only; if accuracy falls much below 95.19%, the central generalization claim is inflated.

Watch

Extended reading notes

Core claim

The central claim is that encoding the same classes.dex bytecode into three semantically loaded color channels—entropy in the red and blue channels, bi-gram transitions in the green channel—makes malware structure visible to CNNs in a way that byte-location color mappings do not. On binary malware-versus-benign classification, MalVis-B with Inception-V3 reaches 95.19% accuracy, 90.81% F1-score, 92.58% precision, 89.10% recall, 87.58% MCC, and 98.06% ROC-AUC, beating each baseline on most backbones, with DenseNet201 noted as the exception. On the imbalanced ten-class task, ResNet50 leads with 84.03% accuracy, and after undersampling to balance classes, a min-confidence voting ensemble restores accuracy to 88.65% with 86.32% F1. The paper also claims that MalVis is the largest public Android malware visualization dataset, containing 1,300,822 images generated from AndroZoo apps and labeled through Euphony and VirusTotal.

Load-bearing premise

The load-bearing premise is that the 1.3 million images can be treated as independent samples in the 80/10/10 split; the paper does not establish that images from the same app or malware family never appear in both training and test partitions, and if they do, the reported accuracy overstates detection of genuinely new apps.

Editorial extensions

If this is right

  • Encrypted, packed, or otherwise obfuscated code should appear as bright, localized high-entropy regions in the red and blue channels, giving CNNs a learnable visual signature rather than a byte-exact signature.
  • Because the green channel encodes transitions between consecutive instructions, repacked or structurally altered bytecode should show visible texture changes, which is why the bi-gram term adds signal beyond entropy alone.
  • The 1.3M-image MalVis dataset gives other research groups a common public benchmark for image-based Android malware detection, removing a data-access bottleneck.
  • On the balanced ten-class task, a min-confidence voting ensemble raises accuracy to 88.65% and F1 to 86.32%, showing that ensemble inference can offset the accuracy lost to undersampling.
  • MalVis-A's failure indicates that arbitrarily adding a semantic channel does not help; the green channel has to encode transition statistics rather than Classbyte colors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct test of the independence assumption would be to group images by source APK, split so no APK appears in both training and test, and rerun the Inception-V3 experiment; if accuracy drops substantially, the 95.19% figure reflects app-specific pattern memorization, not generalization to new apps.
  • The same entropy-plus-N-gram channel decomposition is likely transferable to Windows PE or Linux ELF bytecode, where packed sections also show high entropy and unusual transition patterns, so the method need not be Android-specific in principle.
  • A human-analyst study that asks people to locate encrypted or repacked regions using only the red, blue, and green channels would directly measure the interpretability claim the paper asserts but does not quantify.
  • Varying the sliding-window size (the paper fixes 32 bytes for entropy and two bytes for the bi-gram) might further separate malware families that share obfuscation techniques, since larger windows would capture longer-range structural dependencies at higher computational cost.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces MalVis, a visualization framework and dataset for Android malware classification. MalVis encodes DEX bytecode into RGB images by combining Shannon entropy (red and blue channels) with either Classbyte or bi-gram structural encoding (green channel). The authors construct a dataset of just over 1.3 million images from AndroZoo apps, covering nine malware families and a benign class, and evaluate four/five CNN architectures plus eight ensemble strategies on binary and multiclass tasks. The headline binary result is 95.19% accuracy and 90.81% F1-score with Inception-V3 using the MalVis-B encoding, claimed to outperform prior image-based encodings (MalNet, Classbyte, and the authors' own entropy-only method). The paper also claims zero-day detection capability and positions MalVis as the largest public Android malware visualization dataset.

Significance. If the central results hold, the paper would make a useful contribution: a large public dataset plus a reproducible image-generation pipeline is valuable for the Android malware visualization community. The controlled experiments in Section 3.3, which show the sensitivity of entropy and bi-gram channels to encryption and unstructured bytecode insertion, are a nice interpretability exercise. The comparison across multiple CNN architectures and ensemble methods is also more thorough than many prior works. However, the significance is conditional on resolving a potentially severe data-splitting flaw: with roughly seven images per app, an image-level split could leak app-specific information into the test set and inflate all reported metrics. Because the main claim is about relative ranking of encodings, not just absolute performance, this issue is load-bearing.

major comments (3)
  1. [§3.4, §3.2, Table 1] The split unit is not specified. The dataset contains 1,300,822 images generated from 184,474 apps (Section 3.1), and Section 3.2 states that each DEX file is reshaped into a 256x256 image, implying multiple images per app. If the 80/10/10 partition in Section 3.4 is applied at the image level rather than the app level, images from the same APK or the same malware family can appear in both training and test sets, allowing the CNN to memorize app-specific or family-specific bytecode structure. This would inflate every metric in Tables 2-5, including the headline Inception-V3 result, and could change the ranking between MalVis-B and the entropy-only baseline. The authors must state whether the split is by app or by image, describe how multiple images per app are produced (e.g., chunking large DEX files), and report results with an app-grouped split. Without this, the central claim of superiority over prior encodings is not established.
  2. [Abstract, §5, §6] The abstract and introduction claim improved detection of 'previously unseen (zero-day) malware,' but no experiment evaluates generalization to unseen apps, unseen families, or later time periods. All reported results use a random 80/10/10 split, which does not simulate zero-day conditions. To support the zero-day claim, the authors should add a family-disjoint or temporal split evaluation, or explicitly remove the claim from the abstract and conclusions.
  3. [Tables 2-5] All results are single-run point estimates with no error bars, confidence intervals, or significance tests. Many of the claimed improvements over the entropy-only baseline are small (e.g., Inception-V3 accuracy 95.19% vs 94.94%, F1 90.81% vs 90.43% in Table 2), so it is unclear whether the differences are meaningful or within run-to-run variance. The authors should report mean and standard deviation over multiple random seeds, and ideally a paired significance test, before claiming consistent superiority.
minor comments (4)
  1. [§5.2, Table 3] The text reports that ResNet50 achieved 'overall accuracy of 94.03%,' but Table 3 lists accuracy as 84.03% for this row; 94.03% appears to be the ROC-AUC value. Please correct the text or the table.
  2. [Table 5, §5.4] The description of Min Confidence Voting says predictions are used only when confidence exceeds 60%, but the behavior when no model meets the threshold is not defined. If such samples are excluded from the accuracy computation, the 88.65% accuracy is not directly comparable to the other rows. Clarify the abstention rule.
  3. [§2.2, Table 1] The dataset comparison in Table 1 mixes Android-specific datasets with general (e.g., PE-based) malware image datasets. Clarify for each row whether the images are derived from Android applications, since the claim of being the 'largest Android malware visualization dataset' depends on this distinction.
  4. [Table 2] The header contains a typo: 'Precsion' should be 'Precision'.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: MalVis-B performance is an honest empirical evaluation, and the paper's self-citations are not load-bearing.

full rationale

The central claim—that MalVis-B, combining entropy-based red/blue channels with a bi-gram green channel, outperforms prior image-based Android malware visualizations—is an empirical measurement, not a derivation from the encoding formulas. The encoding itself is fully specified in Algorithm 1 and Eq. (3): red is a deterministic function of Shannon entropy, blue is entropy squared, and green is the normalized two-byte bigram value. No parameter is fitted to the test labels, and neither the entropy formula nor the bi-gram formula assumes the accuracy, F1, precision, recall, MCC, or ROC-AUC values reported in Table 2. The paper does cite the authors' prior work [37] for the entropy-based red/blue encoding and uses that prior method as a baseline, but the formulas are reproduced explicitly in this paper and the comparison is against a published method, not an unverified self-citation chain. The only self-citations appear as background and baselines, none of which is invoked to forbid alternatives or to force the reported conclusion. The dataset split concern raised by the reader—whether 1.3 million images derived from 184,474 apps were split by image rather than by app, potentially causing train/test leakage—is a legitimate correctness and generalization risk, but it is not a circularity of the kind where a prediction reduces to its input by construction. Likewise, the abstract's zero-day generalization claim is unsupported by a temporal or family-disjoint experiment, but absence of evidence is not circularity. Overall, the derivation chain is self-contained: the proposed visualization is a fixed, explainable transformation, and the reported results are an honest benchmark evaluation against external and prior baselines.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical entities. Its encoding relies on hand-chosen constants (entropy window, threshold, curve, bi-gram length, image size) and on domain assumptions about label quality and data independence. The most consequential premise is that the 1.3 million images can be split into train and test without app-level leakage, which the paper does not describe in detail.

free parameters (6)
  • Entropy sliding window size = 32 bytes
    Hand-chosen in Section 3.2; controls the resolution of the red and blue channels; no sensitivity analysis is provided.
  • Entropy threshold for red channel = 0.5
    Algorithm 1 gates the red channel on e > 0.5; this threshold is set by hand and not justified or tuned.
  • Red channel curve exponent = f = (4v - 4v^2)^4
    Algorithm 1 uses this ad hoc nonlinear map from scaled entropy to red intensity; no derivation is given.
  • N-gram window size = 2 bytes (bi-gram)
    Section 3.2.2 states two-byte window was chosen due to computational constraints, not because it is optimal.
  • Image dimensions = 256x256 pixels (resized to 224x224 for models)
    Section 3.2 fixes the reshaped image size without analysis of how this resolution affects detection.
  • Minimum confidence threshold for Min Confidence Voting = 60%
    Section 5.4 introduces this threshold without reporting a search or a sensitivity analysis; it drives the best ensemble result.
assumptions (5)
  • domain assumption DEX byte values, when reshaped into 256x256 images and colored by entropy and N-gram values, preserve discriminative patterns of malicious behavior.
    Central to the method; stated in Sections 3.2 and 3.2.2 without direct evidence beyond classification scores.
  • domain assumption Euphony and VirusTotal labels are accurate ground truth for the nine malware families and the benign set.
    Section 3.1 relies on these external label sources but provides no validation of label accuracy on a sample.
  • domain assumption Images are independent and identically distributed training examples, with no leakage between the 80/10/10 splits at the app or family level.
    Section 3.4 describes the split but does not specify whether the split is at image, app, or family level; this is the weakest premise.
  • domain assumption Pretrained ImageNet CNN weights transfer useful features to malware images.
    Section 2.1 assumes transfer learning effectiveness; no comparison to training from scratch is provided.
  • standard math Standard supervised learning assumptions (fixed label distribution, no adversarial manipulation of test images).
    Implied by the experimental setup; not explicitly discussed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MalVis: A Large-Scale Image-Based Framework and Dataset for Advancing Android Malware Classification." pith.science (2026). https://pith.science/paper/LENRQ4TH

@misc{pith2026250512106,
  author       = {Pith},
  title        = {Pith review of: MalVis: A Large-Scale Image-Based Framework and Dataset for Advancing Android Malware Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LENRQ4TH}},
  note         = {Machine review of arXiv:2505.12106}
}
read the original abstract

As technology advances, Android malware continues to pose significant threats to devices and sensitive data. The open-source nature of the Android OS and the availability of its SDK contribute to this rapid growth. Traditional malware detection techniques, such as signature-based, static, and dynamic analysis, struggle to detect obfuscated threats that use encryption, packing, or compression. While deep learning (DL)-based visualization methods have been proposed, they often fail to highlight the critical malicious features effectively. This research introduces MalVis, a unified visualization framework that integrates entropy and N-gram analysis to emphasize structural and anomalous patterns in malware bytecode. MalVis addresses key limitations of prior methods, including insufficient feature representation, poor interpretability, and limited data accessibility. The framework leverages a newly introduced large-scale dataset, the MalVis dataset, containing over 1.3 million visual samples across nine malware classes and one benign class. We evaluate MalVis against state-of-the-art visualization techniques using leading CNN models: MobileNet-V2, DenseNet201, ResNet50, and Inception-V3. To enhance performance and reduce overfitting, we implement eight ensemble learning strategies. Additionally, an undersampling technique mitigates class imbalance in the multiclass setting. MalVis achieves strong results: 95.19% accuracy, 90.81% F1-score, 92.58% precision, 89.10% recall, 87.58% MCC, and 98.06% ROC-AUC. These findings demonstrate the effectiveness of MalVis in enabling accurate, interpretable malware detection and providing a valuable resource for security research and applications.

Figures

Figures reproduced from arXiv: 2505.12106 by the authors.

Figure 1
Figure 1. An illustration of the structure of an Android APK file, highlighting key components such as application [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Comparison of average file sizes in DEX executables vs malVis PNG representations across malware [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Distribution of malware types and benign in MalVis. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Overview of constructing the MalVis-A visualization method, resulting in RGB image representations using [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Overview of constructing the MalVis-B visualization method using the N-gram encoding in the green RGB [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: An example of a simple for-loop written in Java. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Translation of a Java for-loop into its equivalent JVM instructions in bytecode form after compilation. [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Representation of the employed Bi-gram approach on the Java instructions capturing the semantic transition [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 10
Figure 10. Figure 10: Algorithm illustrating the generation of RGB image representation in the MalVis-B approach, utilizing [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 9
Figure 9. Figure 9: A schematic illustration of the proposed framework architecture is organized into four distinct rows. The [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 11
Figure 11. Figure 11: The impact of 30% AES-256 encryption on Classes.dex file captured by the entropy encoder in the red and blue channels of MalVis representations. 3.3.2 Unstructured bytecode Insertion captured by N-gram in Green Channel In this experiment, we examined the structural se…
Figure 12
Figure 12. Figure 12: The impact of injecting 30% randomized unstructured operations to [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 13
Figure 13. Figure 13: Figure showing the disruption caused by MalVis-A encoding of classbyte in the green channel, which [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 14
Figure 14. Figure 14: Confusion matrices of CNN models trained on the imbalanced multiclass MalVis dataset with the MalVis-B [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]
Figure 15
Figure 15. Figure 15: Confusion matrices for CNN models trained on a balanced multiclass MalVis dataset and the optimal [PITH_FULL_IMAGE:figures/full_fig_p019_15.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. MalVol-25: A Diverse, Labelled and Detailed Volatile Memory Dataset for Malware Detection and Response Testing and Validation

    cs.CR 2025-07 conditional novelty 4.0 of 10

    MalVol-25 is a new dataset of 30 clean and infected Windows memory dumps from 15 malware variants, intended for ML and agentic AI detection research.

Reference graph

Works this paper leans on

65 extracted references · 61 canonical work pages · cited by 1 Pith paper

  1. [1]

    Market share of mobile operating systems worldwide from 2009 to 2024, by quarter

    Ahmed Sherif. Market share of mobile operating systems worldwide from 2009 to 2024, by quarter. Sep 23, 2024

    work page 2009

  2. [2]

    Smartphone operating system share by age group in the u.s

    Statista. Smartphone operating system share by age group in the u.s. as of december 2023, 2024. Accessed: January 31, 2024

    work page 2023

  3. [3]

    Mobile security index (msi) report 2023: Security threats and attacks.https://www.verizon

    Verizon Business. Mobile security index (msi) report 2023: Security threats and attacks.https://www.verizon. com/business/resources/reports/mobile-security-index/ , 2023. Accessed on 10th January 2024

    work page 2023

  4. [4]

    Virus-mnist: A benchmark malware dataset

    David Noever and Samantha E Miller Noever. Virus-mnist: A benchmark malware dataset. arXiv preprint arXiv:2103.00602, 2021

    arXiv 2021

  5. [5]

    Understanding the spreading patterns of mobile phone viruses

    Pu Wang, Marta C González, Cesar A Hidalgo, and Albert-László Barabási. Understanding the spreading patterns of mobile phone viruses. Science, 324(5930):1071–1076, 2009

    work page 2009

  6. [6]

    Recent worms: a survey and trends

    Darrell M Kienzle and Matthew C Elder. Recent worms: a survey and trends. In Proceedings of the 2003 ACM workshop on Rapid Malcode, pages 1–10, 2003

    work page 2003

  7. [7]

    Adware: a review

    Seyhmus Yilmaz and Sultan Zavrak. Adware: a review. International Journal of Computer Science and Information Technologies, 6(6):5599–5604, 2015

    work page 2015

  8. [8]

    An analysis of android adware

    Supraja Suresh, Fabio Di Troia, Katerina Potika, and Mark Stamp. An analysis of android adware. Journal of Computer Virology and Hacking Techniques, 15:147–160, 2019

    work page 2019

Show all 65 references
  1. [9]

    Exploring spyware effects

    Martin Boldt, Bengt Carlsson, and Andreas Jacobsson. Exploring spyware effects. In Nordsec 2004, 2004

    2004

  2. [10]

    Ransomware: A research and a personal case study of dealing with this nasty malware

    Azad Ali. Ransomware: A research and a personal case study of dealing with this nasty malware. Issues in Informing Science and Information Technology, 14:087–099, 2017

    2017

  3. [11]

    Rootkits and their effects on information security.Information Systems Security, 16(3):164–176, 2007

    Lynn Erla Beegle. Rootkits and their effects on information security.Information Systems Security, 16(3):164–176, 2007

    2007

  4. [12]

    Study on computer trojan horse virus and its prevention

    ZHU Zhenfang. Study on computer trojan horse virus and its prevention. International Journal of Engineering and Applied Sciences, 2(8):257840, 2015

    2015

  5. [13]

    Keyloggers: silent cyber security weapons.Network Security, 2020(2):14– 19, 2020

    Akashdeep Bhardwaj and Sam Goundar. Keyloggers: silent cyber security weapons.Network Security, 2020(2):14– 19, 2020

    2020

  6. [14]

    A survey of botnet and botnet detection

    Maryam Feily, Alireza Shahrestani, and Sureswaran Ramadass. A survey of botnet and botnet detection. In 2009 Third International Conference on Emerging Security Information, Systems and Technologies, pages 268–273. IEEE, 2009

    2009

  7. [15]

    A comprehensive survey on identification of malware types and malware classification using machine learning techniques

    Nagababu Pachhala, S Jothilakshmi, and Bhanu Prakash Battula. A comprehensive survey on identification of malware types and malware classification using machine learning techniques. In 2021 2nd International Conference on Smart Electronics and Communication (ICOSEC), pages 120...

    2021

  8. [16]

    Strengthening digital signatures via randomized hashing

    Shai Halevi and Hugo Krawczyk. Strengthening digital signatures via randomized hashing. InAnnual International Cryptology Conference, pages 41–59. Springer, 2006

    2006

  9. [17]

    Obfuscation techniques against signature-based detection: a case study

    Gerardo Canfora, Andrea Di Sorbo, Francesco Mercaldo, and Corrado Aaron Visaggio. Obfuscation techniques against signature-based detection: a case study. In 2015 Mobile systems technologies workshop (MST), pages 21–26. IEEE, 2015

    2015

  10. [18]

    Datdroid: Dynamic analysis technique in android malware detection

    Rajan Thangaveloo, Wong Jing, Kang Leng Chiew, and Johari Abdullah. Datdroid: Dynamic analysis technique in android malware detection. International Journal on Advanced Science, Engineering and Information Technology, 10:536, 03 2020

    2020

  11. [19]

    A systematic literature review of android malware detection using static analysis

    Ya Pan, Xiuting Ge, Chunrong Fang, and Yong Fan. A systematic literature review of android malware detection using static analysis. IEEE Access, 8:116363–116379, 2020

    2020

  12. [20]

    Behavior analysis of malware using machine learning

    Arshi Dhammi and Maninder Singh. Behavior analysis of malware using machine learning. In 2015 Eighth International Conference on Contemporary Computing (IC3), pages 481–486, 2015

    2015

  13. [21]

    Sequential digital signatures for cryptographic software-update authenti- cation

    Bertram Poettering and Simon Rastikian. Sequential digital signatures for cryptographic software-update authenti- cation. In European Symposium on Research in Computer Security, pages 255–274. Springer, 2022

    2022

  14. [22]

    A study on malware and malware detection techniques

    Rabia Tahir. A study on malware and malware detection techniques. International Journal of Education and Management Engineering, 8(2):20, 2018

    2018

  15. [23]

    Obfuscation- resilient android malware analysis based on complementary features

    Cuiying Gao, Minghui Cai, Shuijun Yin, Gaozhun Huang, Heng Li, Wei Yuan, and Xiapu Luo. Obfuscation- resilient android malware analysis based on complementary features. IEEE Transactions on Information Forensics and Security, 2023. 20 A PREPRINT - J ULY 6, 2025

    2023

  16. [24]

    The rise of obfuscated android malware and impacts on detection methods

    Wael F Elsersy, Ali Feizollah, and Nor Badrul Anuar. The rise of obfuscated android malware and impacts on detection methods. PeerJ Computer Science, 8:e907, 2022

    2022

  17. [25]

    Malgene: Automatic extraction of malware analysis evasion signature

    Dhilung Kirat and Giovanni Vigna. Malgene: Automatic extraction of malware analysis evasion signature. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 769–780, 2015

    2015

  18. [26]

    An approach to dynamic malware analysis based on system and application code split

    Anastasia Pereberina, Alexey Kostyushko, and Alexander Tormasov. An approach to dynamic malware analysis based on system and application code split. Journal of Computer Virology and Hacking Techniques, pages 1–11, 2022

    2022

  19. [27]

    Nmal-droid: network- based android malware detection system using transfer learning and cnn-bigru ensemble

    Farhan Ullah, Shamsher Ullah, Gautam Srivastava, Jerry Chun-Wei Lin, and Yue Zhao. Nmal-droid: network- based android malware detection system using transfer learning and cnn-bigru ensemble. Wireless Networks, 30(6):6177–6198, 2024

    2024

  20. [28]

    Malware detection approach based on artifacts in memory image and dynamic analysis

    Rami Sihwail, Khairuddin Omar, Khairul Akram Zainol Ariffin, and Sanad Al Afghani. Malware detection approach based on artifacts in memory image and dynamic analysis. Applied Sciences, 9(18):3680, 2019

    2019

  21. [29]

    A new approach to android malware detection using fuzzy logic-based simulated annealing and feature selection

    Yousef Seyfari and Akbar Meimandi. A new approach to android malware detection using fuzzy logic-based simulated annealing and feature selection. Multimedia Tools and Applications, pages 1–25, 2023

    2023

  22. [30]

    Potential of the dynamic approach to data analysis

    Vera Orlova, Vyacheslav Goiko, Yulia Alexandrova, and Evgeny Petrov. Potential of the dynamic approach to data analysis. In E3S Web of Conferences, volume 258, page 07012. EDP Sciences, 2021

    2021

  23. [31]

    Malware detection in android based on dynamic analysis

    Taniya Bhatia and Rishabh Kaushal. Malware detection in android based on dynamic analysis. In 2017 International conference on cyber security and protection of digital services (Cyber security), pages 1–6. IEEE, 2017

    2017

  24. [32]

    Integrated static analysis for malware variants detection

    Rinu Rani Jose and A Salim. Integrated static analysis for malware variants detection. In Inventive Computation Technologies 4, pages 622–629. Springer, 2020

    2020

  25. [33]

    A large-scale database for graph representation learning

    Scott Freitas, Yuxiao Dong, Joshua Neil, and Duen Horng Chau. A large-scale database for graph representation learning. arXiv preprint arXiv:2011.07682, 2020

    2011 arXiv

  26. [34]

    Hit4mal: Hy- brid image transformation for malware classification.Transactions on Emerging Telecommunications Technologies, 31(11):e3789, 2020

    Duc-Ly Vu, Trong-Kha Nguyen, Tam V Nguyen, Tu N Nguyen, Fabio Massacci, and Phu H Phung. Hit4mal: Hy- brid image transformation for malware classification.Transactions on Emerging Telecommunications Technologies, 31(11):e3789, 2020

    2020

  27. [35]

    Dynamic security analysis on android: A systematic literature review

    Thomas Sutter, Timo Kehrer, Marc Rennhard, Bernhard Tellenbach, and Jacques Klein. Dynamic security analysis on android: A systematic literature review. IEEE Access, 2024

    2024

  28. [36]

    Image visualization based malware detection

    Kesav Kancherla and Srinivas Mukkamala. Image visualization based malware detection. In2013 IEEE Symposium on Computational Intelligence in Cyber Security (CICS), pages 40–44. IEEE, 2013

    2013

  29. [37]

    Improving android malware detection with entropy bytecode-to-image encoding framework

    Saleh J Makkawy, Abdalrahman H Alblwi, Michael J De Lucia, and Kenneth E Barner. Improving android malware detection with entropy bytecode-to-image encoding framework. In 2024 33rd International Conference on Computer Communications and Networks (ICCCN), pages 1–9. IEEE, 2024

    2024

  30. [38]

    Euphony: harmonious unification of cacophonous anti-virus vendor labels for android malware

    Médéric Hurier, Guillermo Suarez-Tangil, Santanu Kumar Dash, Tegawendé F Bissyandé, Yves Le Traon, Jacques Klein, and Lorenzo Cavallaro. Euphony: harmonious unification of cacophonous anti-virus vendor labels for android malware. In Proceedings of the 14th International Confer...

    2017

  31. [39]

    https://www.virustotal.com

    Virustotal - free online virus, malware, and url scanner. https://www.virustotal.com. Accessed: 2024-8-05

    2024

  32. [40]

    Convolutional neural network: a review of models, methodologies and applications to object detection

    Anamika Dhillon and Gyanendra K Verma. Convolutional neural network: a review of models, methodologies and applications to object detection. Progress in Artificial Intelligence, 9(2):85–112, 2020

    2020

  33. [41]

    A survey on deep learning-based lane detection algorithms for camera and lidar

    Min-Hyeok Sun, Seung-Hyun Kong, and Dong-Hee Paek. A survey on deep learning-based lane detection algorithms for camera and lidar. IEEE Transactions on Intelligent Transportation Systems, 2025

    2025

  34. [42]

    D-ddpm: Deep denoising diffusion probabilistic models for lesion segmentation and data generation in ultrasound imaging

    Abdalrahman Alblwi, Saleh Makkawy, and Kenneth E Barner. D-ddpm: Deep denoising diffusion probabilistic models for lesion segmentation and data generation in ultrasound imaging. IEEE Access, 2025

    2025

  35. [43]

    Anomaly detection for in-vehicle network using cnn-lstm with attention mechanism

    Heng Sun, Miaomiao Chen, Jian Weng, Zhiquan Liu, and Guanggang Geng. Anomaly detection for in-vehicle network using cnn-lstm with attention mechanism. IEEE Transactions on Vehicular Technology, 70(10):10880– 10893, 2021

    2021

  36. [44]

    Androzoo: Collecting millions of android apps for the research community

    Kevin Allix, Tegawendé F Bissyandé, Jacques Klein, and Yves Le Traon. Androzoo: Collecting millions of android apps for the research community. In Proceedings of the 13th international conference on mining software repositories, pages 468–471, 2016. 21 A PREPRINT - J ULY 6, 2025

    2016

  37. [45]

    Drebin: Effective and explainable detection of android malware in your pocket

    Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, Konrad Rieck, and CERT Siemens. Drebin: Effective and explainable detection of android malware in your pocket. In Ndss, volume 14, pages 23–26, 2014

    2014

  38. [46]

    Malnet: A large-scale image database of malicious software

    Scott Freitas, Rahul Duggal, and Duen Horng Chau. Malnet: A large-scale image database of malicious software. In Proceedings of the 31st ACM International Conference on Information & Knowledge Management , pages 3948–3952, 2022

    2022

  39. [47]

    A pe header-based method for malware detection using clustering and deep embedding techniques

    Tina Rezaei, Farnoush Manavi, and Ali Hamzeh. A pe header-based method for malware detection using clustering and deep embedding techniques. Journal of Information Security and Applications, 60:102876, 2021

    2021

  40. [48]

    Malware images: visualization and automatic classification

    Lakshmanan Nataraj, Sreejith Karthikeyan, Gregoire Jacob, and Bangalore S Manjunath. Malware images: visualization and automatic classification. In Proceedings of the 8th international symposium on visualization for cyber security, pages 1–7, 2011

    2011

  41. [49]

    Sok: Leveraging transformers for malware analysis

    Pradip Kunwar, Kshitiz Aryal, Maanak Gupta, Mahmoud Abdelsalam, and Elisa Bertino. Sok: Leveraging transformers for malware analysis. arXiv preprint arXiv:2405.17190, 2024

    2024 arXiv

  42. [50]

    An- drodex: Android dex images of obfuscated malware

    Sana Aurangzeb, Muhammad Aleem, Muhammad Taimoor Khan, George Loukas, and Georgia Sakellari. An- drodex: Android dex images of obfuscated malware. Scientific Data, 11(1):212, 2024

    2024

  43. [51]

    Malware classification with deep convolutional neural networks

    Mahmoud Kalash, Mrigank Rochan, Noman Mohammed, Neil DB Bruce, Yang Wang, and Farkhund Iqbal. Malware classification with deep convolutional neural networks. In 2018 9th IFIP international conference on new technologies, mobility and security (NTMS), pages 1–5. IEEE, 2018

    2018

  44. [52]

    Microsoft malware classification challenge (big 2015)

    Alessandro Panconesi, Marian, Will Cukierski, and WWW BIG Cup Committee. Microsoft malware classification challenge (big 2015). https://kaggle.com/competitions/malware-classification, 2015. Kaggle

    2015

  45. [53]

    Advandmal: Adversarial training for android malware detection and family classification

    Chenyue Wang, Linlin Zhang, Kai Zhao, Xuhui Ding, and Xusheng Wang. Advandmal: Adversarial training for android malware detection and family classification. Symmetry, 13(6):1081, 2021

    2021

  46. [54]

    Android malware detection based on image-based features and machine learning techniques

    Halil Murat Ünver and Khaled Bakour. Android malware detection based on image-based features and machine learning techniques. SN Applied Sciences, 2(7):1299, 2020

    2020

  47. [55]

    Dexray: a simple, yet effective deep learning approach to android malware detection based on image representation of bytecode

    Nadia Daoudi, Jordan Samhi, Abdoul Kader Kabore, Kevin Allix, Tegawendé F Bissyandé, and Jacques Klein. Dexray: a simple, yet effective deep learning approach to android malware detection based on image representation of bytecode. In Deployable Machine Learning for Security De...

    2021

  48. [56]

    A novel malware detection and family classifi- cation scheme for iot based on deam and densenet

    Changguang Wang, Ziqiu Zhao, Fangwei Wang, and Qingru Li. A novel malware detection and family classifi- cation scheme for iot based on deam and densenet. Security and Communication Networks, 2021(1):6658842, 2021

    2021

  49. [57]

    Rgb-based android malware detection and classification using convolutional neural network

    Asim Darwaish and Farid Naït-Abdesselam. Rgb-based android malware detection and classification using convolutional neural network. In GLOBECOM 2020-2020 IEEE Global Communications Conference, pages 1–6. IEEE, 2020

    2020

  50. [58]

    Malssl–self-supervised learning for accurate and label-efficient malware classification

    Setia Juli Irzal Ismail, Budi Rahardjo, Tutun Juhana, Yasuo Musashi, et al. Malssl–self-supervised learning for accurate and label-efficient malware classification. IEEE Access, 2024

    2024

  51. [59]

    Androguard tool by google

    Anthony Desnos/ Google.com. Androguard tool by google. https://code.google.com/archive/p/ androguard/, Feb 13, 2013 / 1st January 2024. Accessed: on 8th January 2024

    2013

  52. [60]

    (binvis) a library for drawing space-filling curves like the hilbert curve

    Aldo Cortesi. (binvis) a library for drawing space-filling curves like the hilbert curve. https://github.com/ cortesi/scurve, 2015

    2015

  53. [61]

    Malgra: Machine learning and n-gram malware feature extraction and detection system

    Muhammad Ali, Stavros Shiaeles, Gueltoum Bendiab, and Bogdan Ghita. Malgra: Machine learning and n-gram malware feature extraction and detection system. Electronics, 9(11):1777, 2020

    2020

  54. [62]

    Enhancing malware classifica- tion via self-similarity techniques

    Fangtian Zhong, Qin Hu, Yili Jiang, Jiaqi Huang, Cheng Zhang, and Dinghao Wu. Enhancing malware classifica- tion via self-similarity techniques. IEEE Transactions on Information Forensics and Security, 2024

    2024

  55. [63]

    An automated vision-based deep learning model for efficient detection of android malware attacks

    Iman Almomani, Aala Alkhayer, and Walid El-Shafai. An automated vision-based deep learning model for efficient detection of android malware attacks. IEEE Access, 10:2700–2720, 2022

    2022

  56. [64]

    Machine learning with oversampling and undersampling techniques: overview study and experimental results

    Roweida Mohammed, Jumanah Rawashdeh, and Malak Abdullah. Machine learning with oversampling and undersampling techniques: overview study and experimental results. In 2020 11th international conference on information and communication systems (ICICS), pages 243–248. IEEE, 2020

    2020

  57. [65]

    Handling class imbalance problem using oversampling techniques: A review

    Anjana Gosain and Saanchi Sardana. Handling class imbalance problem using oversampling techniques: A review. In 2017 international conference on advances in computing, communications and informatics (ICACCI), pages 79–85. IEEE, 2017. 22

    2017

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.